Evil Maid Just Got Angrier - cansecwest.com Maid Just Got Angrier.pdf · Evil Maid Just Got Angrier...

Evil Maid Just Got AngrierWhy Full-Disk Encryption With TPM is Insecure on Many Systems

Yuriy Bulygin (@c7zero)

CanSecWest 2013

Outline

1 UEFI BIOS

2 Measured/Trusted Boot

3 The Real World: Bypassing Measured/Trusted Boot

4 Windows BitLocker with TPM

5 Secure Boot

6 What Else?

7 Anything We Can Do?

Outline

1 UEFI BIOS

5 Secure Boot

6 What Else?

Outline

1 UEFI BIOS

5 Secure Boot

6 What Else?

Outline

1 UEFI BIOS

5 Secure Boot

6 What Else?

Outline

1 UEFI BIOS

5 Secure Boot

6 What Else?

Outline

1 UEFI BIOS

5 Secure Boot

6 What Else?

Outline

1 UEFI BIOS

5 Secure Boot

6 What Else?

Outline

1 UEFI BIOS

5 Secure Boot

6 What Else?

Legacy BIOS

CPU Reset vector in ROM → legacy boot block

Basic CPU, chipset initialization →Initialize Cache-as-RAM, load and run from cache →Initialize DIMMs, create address map.. →Enumerate PCIe devices.. →Execute Option ROMs on expansion cards

Load and execute MBR →2nd Stage Boot Loader / OS Loader → OS

or a Full-Disk Encryption Application

or a Bootkit

Legacy BIOS

or a Bootkit

Legacy BIOS

or a Bootkit

Legacy BIOS

or a Bootkit

Security of Legacy BIOS

Old architecture

Unsigned BIOS updates by user-mode applications

Unsigned Option ROMs

Unprotected configuration

SMI Handlers.. have issues [18]

No Secure Boot

Old architecture

No Secure Boot

Old architecture

No Secure Boot

Unified Extensible Firmware Interface (UEFI)

CPU reset vector in ROM →Startup/Security Phase (SEC) →Pre-EFI Initialization (PEI) Phase (chipset/CPU initialization) →Driver Execution Environment (DXE) Phase →OEM UEFI applications (diagnostics, update) →Boot Device Selection (BDS) Phase → UEFI Boot Manager

OS Boot Manager / Loader or Built-in UEFI Shell

Security of UEFI BIOS

UEFI provides framework for signing UEFI binaries including nativeoption ROMs

Signed capsule update

Framework for TCG measured (trusted) boot

UEFI 2.3.1 defines secure (verified, authenticated) boot

Protected configuration (authenticated variables, boot-time only..)

SEC+PEI encapsulate security critical functions (recovery, TPM init,capsule update, configuration locking, SMRAM init/protection..)

So is UEFI BIOS secure?

UEFI specifies all needed pieces but it’s largely up to platformmanufacturers to use them as well as protections offered by hardware

What good are your signed UEFI capsules if firmware ROM is writeable byeveryone?

So is UEFI BIOS secure?

UEFI specifies all needed pieces but it’s largely up to platformmanufacturers to use them as well as protections offered by hardware

What good are your signed UEFI capsules if firmware ROM is writeable byeveryone?

Outline

1 UEFI BIOS

5 Secure Boot

6 What Else?

Measured (Trusted) Boot

Example: TPM Based Full-Disk Encryption Solutions

Pre-OS firmware components are hashed (measured)

Measurements are initiated by startup firmware (Static CRTM)

Measurements are stored in a secure location (TPM PCRs)

Secrets (encryption keys) are encrypted by the TPM and bounded toPCR measurements (sealed)

Can only be decrypted (unsealed) with same PCR measurementsstored in the TPM

This chain guarantees that firmware hasn’t been tampered with

Windows BitLocker

http://technet.microsoft.com/en-us/library/ee449438(v=ws.10).aspx

BitLocker with Trusted Platform Module

Volume Key used to encrypt drive contents is encrypted by the TPMbased on measurements of pre-OS firmware

If any pre-OS firmware component was tampered with, TPMwouldn’t decrypt the key

Ensures malicious BIOS/OROM/MBR doesn’t log the PIN or fakerecovery/PIN screen

Implementation of a Measured Boot

Typical Chain of Measurements

⊗ Initial startup FW at CPU reset vectorPCR[0 ] ← CRTM, UEFI Firmware, PEI/DXE [BIOS]

↖ UEFI Boot and Runtime Services, Embedded EFI OROMs↖ SMI Handlers, Static ACPI Tables

PCR[1 ] ← SMBIOS, ACPI Tables, Platform Configuration DataPCR[2 ] ← EFI Drivers from Expansion Cards [Option ROMs]PCR[3 ] ← [Option ROM Data and Configuration]PCR[4 ] ← UEFI OS Loader, UEFI Applications [MBR]PCR[5 ] ← EFI Variables, GUID Partition Table [MBR Partition Table]PCR[6 ] ← State Transitions and Wake EventsPCR[7 ] ← UEFI Secure Boot keys (PK/KEK) and variables (dbx..)PCR[8 ] ← TPM Aware OS specific hashes [NTFS Boot Sector]PCR[9 ] ← TPM Aware OS specific hashes [NTFS Boot Block]PCR[10] ← [Boot Manager]PCR[11] ← BitLocker Access Control

⊗ Initial startup FW at CPU reset vector

PCR[0 ] ← CRTM, UEFI Firmware, PEI/DXE [BIOS]↖ UEFI Boot and Runtime Services, Embedded EFI OROMs↖ SMI Handlers, Static ACPI Tables

↖ UEFI Boot and Runtime Services, Embedded EFI OROMs

↖ SMI Handlers, Static ACPI TablesPCR[1 ] ← SMBIOS, ACPI Tables, Platform Configuration DataPCR[2 ] ← EFI Drivers from Expansion Cards [Option ROMs]PCR[3 ] ← [Option ROM Data and Configuration]PCR[4 ] ← UEFI OS Loader, UEFI Applications [MBR]PCR[5 ] ← EFI Variables, GUID Partition Table [MBR Partition Table]PCR[6 ] ← State Transitions and Wake EventsPCR[7 ] ← UEFI Secure Boot keys (PK/KEK) and variables (dbx..)PCR[8 ] ← TPM Aware OS specific hashes [NTFS Boot Sector]PCR[9 ] ← TPM Aware OS specific hashes [NTFS Boot Block]PCR[10] ← [Boot Manager]PCR[11] ← BitLocker Access Control

PCR[1 ] ← SMBIOS, ACPI Tables, Platform Configuration Data

PCR[2 ] ← EFI Drivers from Expansion Cards [Option ROMs]PCR[3 ] ← [Option ROM Data and Configuration]PCR[4 ] ← UEFI OS Loader, UEFI Applications [MBR]PCR[5 ] ← EFI Variables, GUID Partition Table [MBR Partition Table]PCR[6 ] ← State Transitions and Wake EventsPCR[7 ] ← UEFI Secure Boot keys (PK/KEK) and variables (dbx..)PCR[8 ] ← TPM Aware OS specific hashes [NTFS Boot Sector]PCR[9 ] ← TPM Aware OS specific hashes [NTFS Boot Block]PCR[10] ← [Boot Manager]PCR[11] ← BitLocker Access Control

PCR[1 ] ← SMBIOS, ACPI Tables, Platform Configuration DataPCR[2 ] ← EFI Drivers from Expansion Cards [Option ROMs]

PCR[3 ] ← [Option ROM Data and Configuration]PCR[4 ] ← UEFI OS Loader, UEFI Applications [MBR]PCR[5 ] ← EFI Variables, GUID Partition Table [MBR Partition Table]PCR[6 ] ← State Transitions and Wake EventsPCR[7 ] ← UEFI Secure Boot keys (PK/KEK) and variables (dbx..)PCR[8 ] ← TPM Aware OS specific hashes [NTFS Boot Sector]PCR[9 ] ← TPM Aware OS specific hashes [NTFS Boot Block]PCR[10] ← [Boot Manager]PCR[11] ← BitLocker Access Control

PCR[1 ] ← SMBIOS, ACPI Tables, Platform Configuration DataPCR[2 ] ← EFI Drivers from Expansion Cards [Option ROMs]PCR[3 ] ← [Option ROM Data and Configuration]

PCR[4 ] ← UEFI OS Loader, UEFI Applications [MBR]PCR[5 ] ← EFI Variables, GUID Partition Table [MBR Partition Table]PCR[6 ] ← State Transitions and Wake EventsPCR[7 ] ← UEFI Secure Boot keys (PK/KEK) and variables (dbx..)PCR[8 ] ← TPM Aware OS specific hashes [NTFS Boot Sector]PCR[9 ] ← TPM Aware OS specific hashes [NTFS Boot Block]PCR[10] ← [Boot Manager]PCR[11] ← BitLocker Access Control

PCR[1 ] ← SMBIOS, ACPI Tables, Platform Configuration DataPCR[2 ] ← EFI Drivers from Expansion Cards [Option ROMs]PCR[3 ] ← [Option ROM Data and Configuration]PCR[4 ] ← UEFI OS Loader, UEFI Applications [MBR]

PCR[5 ] ← EFI Variables, GUID Partition Table [MBR Partition Table]PCR[6 ] ← State Transitions and Wake EventsPCR[7 ] ← UEFI Secure Boot keys (PK/KEK) and variables (dbx..)PCR[8 ] ← TPM Aware OS specific hashes [NTFS Boot Sector]PCR[9 ] ← TPM Aware OS specific hashes [NTFS Boot Block]PCR[10] ← [Boot Manager]PCR[11] ← BitLocker Access Control

PCR[1 ] ← SMBIOS, ACPI Tables, Platform Configuration DataPCR[2 ] ← EFI Drivers from Expansion Cards [Option ROMs]PCR[3 ] ← [Option ROM Data and Configuration]PCR[4 ] ← UEFI OS Loader, UEFI Applications [MBR]PCR[5 ] ← EFI Variables, GUID Partition Table [MBR Partition Table]

PCR[6 ] ← State Transitions and Wake EventsPCR[7 ] ← UEFI Secure Boot keys (PK/KEK) and variables (dbx..)PCR[8 ] ← TPM Aware OS specific hashes [NTFS Boot Sector]PCR[9 ] ← TPM Aware OS specific hashes [NTFS Boot Block]PCR[10] ← [Boot Manager]PCR[11] ← BitLocker Access Control

PCR[1 ] ← SMBIOS, ACPI Tables, Platform Configuration DataPCR[2 ] ← EFI Drivers from Expansion Cards [Option ROMs]PCR[3 ] ← [Option ROM Data and Configuration]PCR[4 ] ← UEFI OS Loader, UEFI Applications [MBR]PCR[5 ] ← EFI Variables, GUID Partition Table [MBR Partition Table]PCR[6 ] ← State Transitions and Wake Events

PCR[7 ] ← UEFI Secure Boot keys (PK/KEK) and variables (dbx..)PCR[8 ] ← TPM Aware OS specific hashes [NTFS Boot Sector]PCR[9 ] ← TPM Aware OS specific hashes [NTFS Boot Block]PCR[10] ← [Boot Manager]PCR[11] ← BitLocker Access Control

PCR[1 ] ← SMBIOS, ACPI Tables, Platform Configuration DataPCR[2 ] ← EFI Drivers from Expansion Cards [Option ROMs]PCR[3 ] ← [Option ROM Data and Configuration]PCR[4 ] ← UEFI OS Loader, UEFI Applications [MBR]PCR[5 ] ← EFI Variables, GUID Partition Table [MBR Partition Table]PCR[6 ] ← State Transitions and Wake EventsPCR[7 ] ← UEFI Secure Boot keys (PK/KEK) and variables (dbx..)

PCR[8 ] ← TPM Aware OS specific hashes [NTFS Boot Sector]PCR[9 ] ← TPM Aware OS specific hashes [NTFS Boot Block]PCR[10] ← [Boot Manager]PCR[11] ← BitLocker Access Control

PCR[1 ] ← SMBIOS, ACPI Tables, Platform Configuration DataPCR[2 ] ← EFI Drivers from Expansion Cards [Option ROMs]PCR[3 ] ← [Option ROM Data and Configuration]PCR[4 ] ← UEFI OS Loader, UEFI Applications [MBR]PCR[5 ] ← EFI Variables, GUID Partition Table [MBR Partition Table]PCR[6 ] ← State Transitions and Wake EventsPCR[7 ] ← UEFI Secure Boot keys (PK/KEK) and variables (dbx..)PCR[8 ] ← TPM Aware OS specific hashes [NTFS Boot Sector]

PCR[9 ] ← TPM Aware OS specific hashes [NTFS Boot Block]PCR[10] ← [Boot Manager]PCR[11] ← BitLocker Access Control

PCR[1 ] ← SMBIOS, ACPI Tables, Platform Configuration DataPCR[2 ] ← EFI Drivers from Expansion Cards [Option ROMs]PCR[3 ] ← [Option ROM Data and Configuration]PCR[4 ] ← UEFI OS Loader, UEFI Applications [MBR]PCR[5 ] ← EFI Variables, GUID Partition Table [MBR Partition Table]PCR[6 ] ← State Transitions and Wake EventsPCR[7 ] ← UEFI Secure Boot keys (PK/KEK) and variables (dbx..)PCR[8 ] ← TPM Aware OS specific hashes [NTFS Boot Sector]PCR[9 ] ← TPM Aware OS specific hashes [NTFS Boot Block]

PCR[10] ← [Boot Manager]PCR[11] ← BitLocker Access Control

PCR[1 ] ← SMBIOS, ACPI Tables, Platform Configuration DataPCR[2 ] ← EFI Drivers from Expansion Cards [Option ROMs]PCR[3 ] ← [Option ROM Data and Configuration]PCR[4 ] ← UEFI OS Loader, UEFI Applications [MBR]PCR[5 ] ← EFI Variables, GUID Partition Table [MBR Partition Table]PCR[6 ] ← State Transitions and Wake EventsPCR[7 ] ← UEFI Secure Boot keys (PK/KEK) and variables (dbx..)PCR[8 ] ← TPM Aware OS specific hashes [NTFS Boot Sector]PCR[9 ] ← TPM Aware OS specific hashes [NTFS Boot Block]PCR[10] ← [Boot Manager]

PCR[11] ← BitLocker Access Control

Outline

1 UEFI BIOS

5 Secure Boot

6 What Else?

The Problem

Startup UEFI BIOS firmware at reset vector is inherently trusted

To initiate chain of measurements or signature verification

But it’s firmware and can be updated

If subverted, all measurements in the chain can be forged allowingfirmware modifications to go undetected

The Problem

Startup UEFI BIOS firmware at reset vector is inherently trusted

To initiate chain of measurements or signature verification

But it’s firmware and can be updated

If subverted, all measurements in the chain can be forged allowingfirmware modifications to go undetected

The Solution is Simple

Just let BitLocker rely on all platform manufacturers

to protect the UEFIBIOS from programmable SPI writes by malware, allow only signed UEFIBIOS updates, protect authorized update software, update the boot block(SEC/PEI code) securely, correctly program and protect SPI Flashdescriptor, lock the SPI controller configuration, and not introduce a singlebug in all of this, of course.

Just let BitLocker rely on all platform manufacturers to protect the UEFIBIOS from programmable SPI writes by malware

, allow only signed UEFIBIOS updates, protect authorized update software, update the boot block(SEC/PEI code) securely, correctly program and protect SPI Flashdescriptor, lock the SPI controller configuration, and not introduce a singlebug in all of this, of course.

Just let BitLocker rely on all platform manufacturers to protect the UEFIBIOS from programmable SPI writes by malware, allow only signed UEFIBIOS updates

, protect authorized update software, update the boot block(SEC/PEI code) securely, correctly program and protect SPI Flashdescriptor, lock the SPI controller configuration, and not introduce a singlebug in all of this, of course.

Just let BitLocker rely on all platform manufacturers to protect the UEFIBIOS from programmable SPI writes by malware, allow only signed UEFIBIOS updates, protect authorized update software

, update the boot block(SEC/PEI code) securely, correctly program and protect SPI Flashdescriptor, lock the SPI controller configuration, and not introduce a singlebug in all of this, of course.

Just let BitLocker rely on all platform manufacturers to protect the UEFIBIOS from programmable SPI writes by malware, allow only signed UEFIBIOS updates, protect authorized update software, update the boot block(SEC/PEI code) securely

, correctly program and protect SPI Flashdescriptor, lock the SPI controller configuration, and not introduce a singlebug in all of this, of course.

Just let BitLocker rely on all platform manufacturers to protect the UEFIBIOS from programmable SPI writes by malware, allow only signed UEFIBIOS updates, protect authorized update software, update the boot block(SEC/PEI code) securely, correctly program and protect SPI Flashdescriptor

, lock the SPI controller configuration, and not introduce a singlebug in all of this, of course.

Just let BitLocker rely on all platform manufacturers to protect the UEFIBIOS from programmable SPI writes by malware, allow only signed UEFIBIOS updates, protect authorized update software, update the boot block(SEC/PEI code) securely, correctly program and protect SPI Flashdescriptor, lock the SPI controller configuration

, and not introduce a singlebug in all of this, of course.

Just let BitLocker rely on all platform manufacturers to protect the UEFIBIOS from programmable SPI writes by malware, allow only signed UEFIBIOS updates, protect authorized update software, update the boot block(SEC/PEI code) securely, correctly program and protect SPI Flashdescriptor, lock the SPI controller configuration, and not introduce a singlebug in all of this, of course.

Follow The Guidelines

SPI Flash / BIOS Protections

1 Write Protection of BIOS Region in SPI Flash

2 Read/Write Protection via SPI Protected Range Registers

3 SPI Flash Region Access Control Defined in Flash Descriptor

Write Protecting BIOS Region in SPI Flash

http://www.intel.com/content/www/us/en/chipsets/6-chipset-c200-chipset-datasheet.html

SPI Protected Range Registers

http://www.intel.com/content/www/us/en/chipsets/6-chipset-c200-chipset-datasheet.html

Welcome to the Desert of the Real (ASUS P8P67-M PRO)

Let’s Just Try to Write to UEFI BIOS, Shall We?

Hey! We’ve Succeeded!

I Have a Suspicion..

NIST BIOS Protection Guidelines Recap

http://csrc.nist.gov/publications/nistpubs/800-147/NIST-SP800-147-April2011.pdf

UEFI Updates Aren’t Exactly Signed Either

NIST BIOS Protection Guidelines Recap

http://csrc.nist.gov/publications/nistpubs/800-147/NIST-SP800-147-April2011.pdf

Outline

1 UEFI BIOS

5 Secure Boot

6 What Else?

Angry Evil Maid

Attack Outline Against Encrypted OS Drive

1 While the owner is not watching and system is shut down..

2 adversary plugs in and boots into a USB thumb drive

3 which auto launches exploit directly modifying UEFI BIOS inunprotected SPI Flash

4 Gets out until owner notices someone is messing with the system

5 Upon next boot, patched UEFI BIOS sends expected ’good’measurements of all pre-boot components to TPM PCRs

6 TPM unseals the encryption key as the measurements are correct

Angry Evil Maid

Booting From Multiple OS Drives?

1 System has multiple encrypted OS bootable drives (includingbootable USB thumb drives)

2 OS is loaded while other OS drives are encrypted

3 Malware compromised loaded OS exploits weak BIOS protections andmodifies UEFI BIOS

4 When OS is booted from another encrypted drive, compromised UEFIBIOS submits expected ’good’ measurements to the TPM

5 TPM unseals OS drive encryption key as measurements are correct

6 OS boots on top of compromised firmwware logging PIN

The Original Boot Block

Now beeping SOS.. (not exactly a PIN logger)

Writing Payload to Early BIOS in SPI Flash

BitLocker Decrypted Drive With Patched UEFI BIOS

But That P67 Board Is Just Too Old

ASUS P8Z77-V PRO

Yes! UEFI BIOS updates are signed

NIST will be happy

ASUS P8Z77-V PRO

Yes! UEFI BIOS updates are signed

NIST will be happy

Or Not Yet

The problem applies to any Full-Disk Encryption solution with TPM,not just Windows BitLocker

It also is not specific to ASUS. I just happen to use a few of thosesystems

Outline

1 UEFI BIOS

5 Secure Boot

6 What Else?

What About Secure Boot?

UEFI 2.3.1 / Windows 8 Secure Boot

UEFI FW verifies digital signatures of non-embedded UEFIexecutables

Signed UEFI drivers on adaptor cards/disk (Option ROMs), UEFIapps, OS Loaders

Leverages Authenticode signing over PE/COFF binaries

Configuration stored in NVRAM as Authenticated Variables (PK,KEK, db, dbx, SecureBoot)

UEFI Spec, Chapter 27

Windows 8 Logo requirements for Secure Boot

Windows 8 Logo Requirements

System.Fundamentals.Firmware.UEFISecureBoot

Outline

1 UEFI BIOS

5 Secure Boot

6 What Else?

BIOS Rootkits

BIOS Rootkit [5,6,7,15]

SMM Rootkit [8,9]

ACPI rootkit [12]

Mebromi - BIOS/Option ROM malware in the wild [14]

If we don’t properly protect the BIOS, malware will

Imagine BIOS malware restoring TDL4 infected MBR on each boot

BIOS Rootkits

BIOS Rootkit [5,6,7,15]

SMM Rootkit [8,9]

ACPI rootkit [12]

Mebromi - BIOS/Option ROM malware in the wild [14]

If we don’t properly protect the BIOS, malware will

Imagine BIOS malware restoring TDL4 infected MBR on each boot

Outline

1 UEFI BIOS

5 Secure Boot

6 What Else?

Anything We Can Do?

If you care about Full-Disk Encryption or sneaky little UEFI malware

ASUS is releasing fixed revision of UEFI BIOS. Update!

Check with platform vendor if BIOS updates are signed and if BIOSmeets NIST SP800-147 requirements

Systems certified for Windows 8 are likely to sign UEFI updates

Check UEFI BIOS protections on your system

Do not leave your system unattended

Do not enter PIN if concerned that BIOS was compromised

Stop using systems with legacy BIOS

NIST should have a test suite to validate SP800-147 requirements

Acknowledgements / Greetings

CSW organizers and review board

ASUS for openly working with us on mitigations

apebit, Kirk Brannock, chopin, doughty, Efi, Laplinker, Lelia, DhineshManoharan, Misha, Bruce Monroe, Monty, Nick, Brian Payne, rfp,secoeites, sharkey, toby, Vincent

And many others whom I deeply respect

Graphics from http://www.deviantart.com

Evil Maid Just Got Angrier - cansecwest.com Maid Just Got Angrier.pdf · Evil Maid Just Got Angrier...

Documents

Agency Me Maid

Maid of Honor Speeches

IOM X BANGLADESH ROADSHOW · three maids together happy employer paying happy maid maid taking a day o" (maybe 2 maids together having co"ee??) maid washing a dog maid putting !owers

Contentsimg.chinafoodsltd.com/Uploads/Zgsp/File/2018/08/24/u5b7...“Minute Maid” brand, namely “Minute Maid Tropical Pulpy” and “Minute Maid Refreshing Pulpy Grape”, were

Maid in Disguise

Welcome to MAID

Kaigchouwa Maid Sama

Sun maid cookbook (1.52MB)

Maid in Boston

Maid for Hire

Sun Maid Cookbook

Closet Maid Project Planner

Maid Jourv2.0

Medical Assistance in Dying (MAiD) A Guide to Support People Requesting MAiD · Medical Assistance in Dying (MAiD) A Guide to Support People Requesting MAiD This guide answers questions

The Ruined Maid

Molly Maid brochure

Baltic Maid

maid guide final.pdf

DISPOSABLE - Mini-Maid

Ppt maid asleep